fix(nixos): address Nix review findings

Render Palworld secrets through its documented settings file and remove stale RCON configuration.

Harden generated commands, centralize shared modules, and codify the reviewed Nix conventions.

src/skills/style/nix/rules/flake.md

@@ -11,3 +11,13 @@ Use `flake.nix` to pass inputs into that implementation.
 ### Rationale
 
 This keeps dependency declarations separate from output logic.
+
+## Describe flake apps
+
+### Rule
+
+Set `meta.description` on every flake app.
+
+### Rationale
+
+Flake tools can display each app's purpose without emitting a missing-metadata warning.

src/skills/style/nix/rules/general.md

@@ -50,3 +50,91 @@ Do not read `config.home-manager.users.<user>.programs.<name>.package` for comma
 Home Manager uses the NixOS package set in this repository.
 `pkgs.<name>` avoids dependency paths through the user tree under Home Manager.
 Configured NixOS package options preserve package selection when a module owns the tool.
+
+## Configure services through documented interfaces
+
+### Rule
+
+Use current upstream documentation when mapping Nix options to service arguments or configuration files.
+Do not expose undocumented service arguments as module options.
+
+### Rationale
+
+Documented interfaces preserve configuration behavior across service updates.
+
+## Keep module options effective
+
+### Rule
+
+Every custom module option must change the generated configuration or behavior.
+Remove unused options instead of exposing speculative configuration.
+
+### Rationale
+
+An inert option promises behavior that the module does not provide.
+
+## Separate public and private addresses
+
+### Rule
+
+Do not assign a private guest address to an option that advertises a public service address.
+Leave optional public-address settings unset when the service can detect them.
+
+### Rationale
+
+Private addresses are not routable by public clients.
+
+## Separate display names from identifiers
+
+### Rule
+
+Do not derive systemd unit names or other machine identifiers from unrestricted display names.
+Give identifiers constrained types or fixed values.
+
+### Rationale
+
+Display names can contain characters that machine interfaces reject or reinterpret.
+
+## Terminate command options before variable paths
+
+### Rule
+
+In generated shell text, pass `--` before variable-derived path operands when the command supports it.
+
+### Rationale
+
+Values that start with a hyphen remain operands instead of command options.
+
+## Compose repository modules once
+
+### Rule
+
+Add shared NixOS modules to `repositoryModules` in `src/dotfiles/default.nix`.
+Import `repositoryModules` into each host and guest.
+Do not pass a shared module through a separate parallel parameter.
+
+### Rationale
+
+A single module collection prevents host and guest configurations from diverging.
+
+## Generate identical named attributes
+
+### Rule
+
+Use `lib.genAttrs` when a fixed list of attribute names shares one value.
+Do not repeat identical attribute bodies.
+
+### Rationale
+
+One definition prevents copied settings from diverging.
+
+## Import tracked host hardware directly
+
+### Rule
+
+Import each tracked `hardware-configuration.nix` directly from its host module.
+Do not guard the import with `builtins.pathExists`.
+
+### Rationale
+
+A missing hardware description must fail evaluation instead of silently changing the host configuration.